AegisAgent — AI Agent Runtime Security Gateway

AI Agent Runtime Security Gateway — cryptographically binds every tool call to the authentic model completion, zero-trust policy enforcement, and integrated sandbox isolation and human approval.

Background: Why AegisAgent

In August 2026, the Cloud Security Alliance disclosed the CoreBreak vulnerability family, a series of critical vulnerabilities that completely shattered the security assumptions of the AI Agent ecosystem:

At the same time, sandbox escape attack techniques are maturing. Agents executing tool calls (shell commands, file operations, network requests) without constraints have become the biggest obstacle to enterprise AI Agent deployment.

AegisAgent was built precisely for this.

Core Capabilities

1. Provenance Attestation

Every tool call is cryptographically bound via signature to the LLM completion that produced it. Unforgeable, non-replayable, tamper-evident.

2. Policy Engine

A declarative DSL defines security policies: fine-grained access control based on role, tool type, argument patterns, call frequency, and data sensitivity.

3. Detection Layer

Real-time detection of prompt injection, anomalous tool calls, privilege escalation attempts, and data exfiltration patterns. Detection rules are continuously updated via signature packs.

4. Sandbox Isolation

Multi-layer isolation strategy: process-level → container-level → gVisor/Firecracker microVM. Every tool call executes in an isolated sandbox.

5. HITL Approval

High-risk operations automatically trigger a human approval workflow. Supports Slack/Teams/PagerDuty notifications, with automatic rejection on timeout.

6. MCP Security Proxy

Adds mutual authentication, call auditing, result validation, and rate limiting to the MCP protocol. Compatible with the Anthropic MCP specification.

7. LLM Gateway

A unified LLM call entry point supporting OpenAI / Anthropic / local models, with automatic security headers, routing policies, and fallback logic.

Architecture Overview

┌─────────────────────────────────────────────────────────────────┐
│                      Agent Application                          │
│  (LangChain / AutoGen / CrewAI / Custom Agent)                 │
└───────────────────────┬─────────────────────────────────────────┘
                        │ tool_call(request)
                        ▼
┌─────────────────────────────────────────────────────────────────┐
│                     AegisAgent Gateway                           │
│  ┌─────────────┐  ┌──────────────┐  ┌───────────────────────┐  │
│  │  Provenance │  │   Policy     │  │   Detection Engine    │  │
│  │  Attestation│→ │   Engine     │→ │   (Signatures + ML)   │  │
│  └─────────────┘  └──────┬───────┘  └───────────┬───────────┘  │
│                          │                       │              │
│  ┌─────────────┐  ┌──────▼───────┐  ┌───────────▼───────────┐  │
│  │  Sandbox    │  │   HITL       │  │   Audit & Logging     │  │
│  │  Isolator   │  │   Approval   │  │   (Tamper-Evident)    │  │
│  └─────────────┘  └──────────────┘  └───────────────────────┘  │
└───────────────────────┬─────────────────────────────────────────┘
                        │ verified_tool_call
                        ▼
┌─────────────────────────────────────────────────────────────────┐
│              MCP Servers / Tool Executors                        │
│  (authenticated, audited, sandboxed)                            │
└─────────────────────────────────────────────────────────────────┘

Quick Start

Installation

# Basic installation (zero dependencies, standard library only)
pip install aegisagent

# Full installation (includes server, storage, crypto, providers)
pip install aegisagent[all]

# Development installation
pip install aegisagent[all,dev]

Initialization

# Generate default configuration
aegis init

# Start the gateway service
aegis serve --host 0.0.0.0 --port 8901

# Check health status
curl http://localhost:8901/health

5-Line Code Integration

from aegis import AegisClient

client = AegisClient(policy="default")
result = client.evaluate_and_execute(
    tool="shell.exec",
    args={"command": "ls -la"},
    provenance={"model": "gpt-4", "trace_id": "abc-123"}
)
print(result.status)  # "allowed" | "denied" | "needs_approval"

CVE Defense Mapping

CLI Reference

aegis init                    # Initialize config directory
aegis serve [--port 8901]     # Start the gateway service
aegis policy validate         # Validate policy file syntax
aegis policy simulate         # Simulate policies (what-if)
aegis detect scan             # Scan current detection rules
aegis sandbox exec <cmd>      # Execute a command in the sandbox
aegis audit export            # Export audit logs
aegis redteam run <suite>     # Run red team test suite
aegis version                 # Display version information

Deployment

Docker

docker build -t aegisagent:latest .
docker run -p 8901:8901 -p 8902:8902 aegisagent:latest

Docker Compose

docker compose up -d

Kubernetes

kubectl apply -f deploy/k8s/

See docs/deployment.md for details.

Project Structure

aegisagent/
├── aegis/                  # Core runtime library
│   ├── attestation/        # Provenance attestation module
│   ├── policy/             # Policy engine
│   ├── detect/             # Detection layer
│   ├── sandbox/            # Sandbox isolation
│   ├── approval/           # Human approval
│   ├── mcp/                # MCP security proxy
│   ├── gateway/            # LLM gateway
│   ├── audit/              # Audit logs
│   ├── redteam/            # Red team testing
│   └── cli/                # CLI tools
├── docs/                   # Documentation
├── examples/               # Examples
├── tests/                  # Tests
├── deploy/                 # Deployment configs
├── pyproject.toml
├── Dockerfile
├── docker-compose.yaml
└── Makefile

Contributing

Contributions are welcome! Please read CONTRIBUTING.md to learn about the development workflow and coding standards.

Found a security vulnerability? Report it through the process described in SECURITY.md — do not discuss it in public issues.

License

Apache License 2.0 — see LICENSE for details.

_{Built with security-first principles for the AI Agent era.}

CVE-2026-18830	LLM Tool Call Chain	Model completion results can be tampered with by a man-in-the-middle; there is no cryptographic binding between tool calls and LLM responses
CVE-2026-18236	MCP Protocol Layer	Model Context Protocol lacks mutual authentication; malicious MCP servers can inject arbitrary tool results
CVE-2026-64650	Sandbox Runtime	Container sandbox escape vulnerability; Agent tool execution environments can break through isolation boundaries
CVE-2026-64651	Privilege Escalation	Agent tool-call permissions are not properly isolated; a single point of compromise can lead to full system takeover
CVE-2026-12537	Policy Bypass	Traditional string-matching guardrails can be easily bypassed via prompt injection

CVE-2026-18830 (Tool Call Tampering)	Provenance Attestation — Ed25519 signature binds every call	✅ Defended
CVE-2026-18236 (MCP Injection)	MCP Security Proxy — mutual mTLS + result validation	✅ Defended
CVE-2026-64650 (Sandbox Escape)	Multi-layer isolation — gVisor/Firecracker + seccomp	✅ Defended
CVE-2026-64651 (Privilege Escalation)	Policy Engine — least privilege + dynamic privilege downgrade	✅ Defended
CVE-2026-12537 (Policy Bypass)	Detection Layer — semantic analysis + behavioral baselines + hot-updated signature packs	✅ Defended

aegisagent

Most Popular